Hello,
I have got a few events with the fields "Information" and "Name". Few events look like below, and I have many such events.
25/08/2018 Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" , Name="abc"
26/08/2018 Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" , Name="xyz"
The values of the fields are not consistent and it might shuffle the position.
For an instance, The details-dist-Hyderabad in the first event is at position 1 but in the second event it is in the position 2.
I would like to extract the values which contain "details" to a new field and should be placed in a order. So I can use this field for the further extraction.
Output should look like below.
newField = "details-dist-Hyderabad,details-state-Telangana,details-local-abc"
newField = "details-dist-Bangalore,details-state-Karnataka,details-local-xyz"
Hi @bollam,
Try this run anywhere search..
| makeresults a=1
| eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info"
| append
[ makeresults a1=1
|eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz"
]
|rex max_match=0 field=Information "details-dist-(?P\w+)"
|rex max_match=0 field=Information "details-state-(?P\w+)"
|rex max_match=0 field=Information "details-local-(?P\w+)"
|eval newField="details-dist-".dist.",details-state-".state.",details-local-".local
|fields - dist,local,state
Hi @bollam,
Try this run anywhere search..
| makeresults a=1
| eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info"
| append
[ makeresults a1=1
|eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz"
]
|rex max_match=0 field=Information "details-dist-(?P\w+)"
|rex max_match=0 field=Information "details-state-(?P\w+)"
|rex max_match=0 field=Information "details-local-(?P\w+)"
|eval newField="details-dist-".dist.",details-state-".state.",details-local-".local
|fields - dist,local,state
@nadlurinadluri, It worked, Thanks for the quick help!!
Glad that it helped you 🙂 Happy Splunking!!